A fake social media account using your name, photos, job title, or business identity to ask people for money is more than an online nuisance. It can expose you to reputational damage, frightened relatives, angry scam victims, and questions from banks or law enforcement. The most important steps are to preserve the evidence before it disappears, warn potential victims, report any financial transactions immediately, secure your real accounts, and file a properly documented cybercrime complaint.

Act quickly, but do not rush into publicly accusing a person unless you have reliable proof. The visible account may be operated through stolen credentials, a prepaid number, a money mule, or a person located outside the Philippines.

Is Creating a Fake Social Media Account Illegal in the Philippines?

Creating an account under another person’s identity is not automatically criminal in every situation. A harmless fan page, disclosed role-playing account, or obvious parody may be treated differently from an account designed to deceive.

The legal problem becomes serious when someone intentionally uses identifying information belonging to another person or organization without authority, especially to obtain money, financial details, passwords, one-time PINs, or other benefits.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person without right. A “juridical person” includes a corporation or other legal entity, so the provision can also cover fake accounts impersonating a company, association, school, or registered business. (Lawphil)

Computer-related identity theft is punishable by prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount proportionate to the damage, or both. If no damage has yet occurred, the penalty may be one degree lower. This means you do not necessarily have to wait until somebody loses money before reporting the account. (Supreme Court E-Library)

In Disini v. Secretary of Justice, G.R. No. 203335, February 18, 2014, the Supreme Court rejected the constitutional challenge to the computer-related identity theft provision. (Supreme Court E-Library)

Other Philippine Laws That May Apply

The exact charges depend on what the fake account did, what information it used, and whether anyone suffered financial or reputational harm.

Estafa through false pretenses

If the impersonator convinces someone to send money by pretending to be you, the facts may constitute estafa, or swindling, under Article 315(2)(a) of the Revised Penal Code.

The usual elements are:

The offender made a false representation before or at the time of the transaction.
The victim relied on that representation.
The victim parted with money or property because of the deception.
The victim suffered damage.

Using a fictitious name or falsely claiming authority, ownership, agency, qualifications, credit, or business connections may support an estafa charge. When a Revised Penal Code offense is committed through information and communications technology, Section 6 of RA 10175 may also affect the penalty. The prosecutor determines the appropriate charges based on the evidence and the distinct elements of each offense. (Lawphil)

Computer-related forgery or fraud

A scammer who fabricates digital IDs, receipts, contracts, company letters, booking confirmations, or payment records may also commit computer-related forgery or fraud under RA 10175.

Forgery may include creating or altering computer data so that it appears authentic and will be relied upon for legal or fraudulent purposes. Computer-related fraud generally involves unauthorized manipulation of computer data or systems causing damage with fraudulent intent. (Supreme Court E-Library)

Anti-Financial Account Scamming Act

The Anti-Financial Account Scamming Act, Republic Act No. 12010 of 2024, applies when financial accounts, bank accounts, cards, or e-wallets are used in scams.

It penalizes activities such as:

Opening a financial account using another person’s identity or identification documents;
Lending, selling, renting, or allowing the use of an account to receive criminal proceeds;
Recruiting money mules;
Obtaining sensitive financial information through deceptive electronic communications; and
Pretending to represent a bank or financial institution to obtain account credentials.

A person whose account received scam proceeds is not automatically guilty. Knowledge, purpose, participation, and the surrounding circumstances matter. However, willingly allowing an account to be used to receive or transfer criminal proceeds can lead to serious liability. (Lawphil)

Data Privacy Act

The unauthorized collection or use of your photograph, identification document, address, contact details, or other personal information may also raise issues under the Data Privacy Act of 2012, Republic Act No. 10173.

A complaint before the National Privacy Commission is particularly relevant when:

A business, employer, lending company, platform, or organization improperly disclosed your data;
A known person or entity unlawfully processed or published your personal information;
Your data was taken from a breach or improperly secured database; or
A personal information controller failed to respond appropriately after being notified.

The NPC is not a substitute for a police or NBI cybercrime investigation. It may also be difficult to pursue an administrative privacy complaint against a completely unidentified account operator. (National Privacy Commission)

Civil damages

Articles 19, 20, and 21 of the Civil Code protect people against dishonest, unlawful, abusive, or malicious conduct that causes injury. Once the impersonator is identified, the identity owner may seek actual damages, moral damages for serious anxiety or reputational harm, and, in proper cases, exemplary damages and attorney’s fees.

A civil claim requires proof of the defendant’s identity, wrongful act, causation, and resulting injury. Screenshots showing that an account existed may not, by themselves, prove who operated it. (Lawphil)

What to Do Immediately

1. Preserve the fake account before reporting it

Platforms may remove an account quickly, but removal can also erase information that would help investigators. Collect the evidence first unless people are in immediate danger.

Capture:

The complete profile and cover image;
The exact username and display name;
The full profile URL, not merely a screenshot of the name;
Any visible account or user identification number;
The account’s creation information, if displayed;
Posts, stories, comments, advertisements, and marketplace listings;
Private messages sent to you or other victims;
Bank account numbers, e-wallet numbers, QR codes, and payment instructions;
Telephone numbers, email addresses, websites, and messaging handles;
Dates, times, reactions, shares, and names of recipients;
Fake IDs, receipts, contracts, or authorization letters; and
Messages in which the account claims to be you.

Make a screen recording that begins with the device’s date and time, opens the social media application or browser, and navigates from the account profile to the fraudulent posts or messages. This helps show context that may be lost in isolated screenshots.

Keep unedited copies. Do not crop, highlight, write on, or compress your only copy of the evidence.

2. Ask scam recipients to preserve their own evidence

The person whose identity was stolen and the person who sent money are often different complainants.

Ask each recipient to retain:

The full conversation;
Their device and original message history;
The fake account’s URL;
Payment receipts and transaction reference numbers;
Confirmation emails or SMS messages;
The beneficiary account name and number;
Any telephone calls or voice messages; and
A chronological written account of what happened.

A screenshot forwarded to you is useful, but the original recipient is usually in a better position to authenticate the conversation and explain why they believed the account was genuine.

Under the Rules on Electronic Evidence, electronic records can be admitted in court, but the person presenting them must establish their authenticity. A printout may qualify as the equivalent of an original when it accurately reflects the electronic data. Testimony or an affidavit from the person who captured, received, or maintained the record can be important. (Supreme Court E-Library)

3. Warn people through your real account

Post a short, factual warning through your verified or established account. State:

The exact fake username;
That the account is not controlled or authorized by you;
That you are not soliciting money, investments, loans, or emergency assistance;
That recipients should not click links or disclose OTPs; and
Where suspicious messages should be forwarded.

Avoid reposting complete bank account details or unredacted IDs publicly. Give those details to the platform, financial institution, and investigators instead.

For a business, send a formal notice to employees, clients, suppliers, and payment partners. Identify the only legitimate payment channels and require telephone or video confirmation for unusual payment requests.

4. Secure your genuine accounts

Determine whether the scammer merely cloned your profile or actually accessed your account.

For a cloned account:

Change your passwords as a precaution;
Enable multi-factor authentication;
Restrict public access to friends lists, birth dates, telephone numbers, and family information;
Review third-party applications connected to the account; and
Remove old public posts containing IDs, signatures, tickets, or financial documents.

For a compromised account:

Use the platform’s account-recovery process;
Sign out all active sessions;
Change the password of the associated email account first;
Check for changed recovery addresses or telephone numbers;
Preserve security alerts showing unfamiliar logins; and
Inform contacts that previous messages may have been sent by an intruder.

5. Report the account to the platform

Report both the account and the individual scam posts or messages. Ask people who directly received the fraudulent solicitation to submit their own reports.

Official reporting options include the:

Meta may ask for a government-issued ID. Provide it only through the platform’s official reporting page, not through links sent by the suspected fake account. (Facebook)

Keep the confirmation email, ticket number, and date of every platform report. A successful takedown limits further harm, but it does not identify the offender or replace a criminal complaint.

6. Contact the bank or e-wallet immediately

When money has been sent, the sender should report the disputed transaction to the originating bank or e-wallet without delay. The identity owner may also report that their name is being used to induce transactions.

Provide:

Transaction reference number;
Amount and time of transfer;
Source and beneficiary institutions;
Account or e-wallet numbers;
Beneficiary name as displayed;
Screenshots of the fraudulent messages;
Police, NBI, or CICC reference number, if already available; and
A request to trace, flag, and temporarily hold the disputed funds.

Under RA 12010 and BSP Circular No. 1215, supervised financial institutions may temporarily hold disputed funds and conduct coordinated verification. The implementing rules provide for an initial hold of up to five calendar days and, when justified, an extended hold of up to 25 additional calendar days. A hold does not guarantee recovery; it is most useful before the funds are withdrawn or transferred through multiple accounts. (Lawphil)

Ask for a written acknowledgment and case number. If the first customer-service representative treats the report as a routine transfer dispute, clearly state that it involves fraud, impersonation, social engineering, or a disputed transaction under RA 12010.

Where to Report the Fake Account in the Philippines

NBI Cybercrime Division

The NBI Cybercrime Division’s Citizen’s Charter states that members of the public may file a complaint or request an investigation. The intake process generally includes a preliminary interview, preparation of a sworn complaint sheet, collection of supporting documents, witness statements, and examination of relevant devices.

The listed frontline intake time is approximately one hour and ten minutes, but this does not include the full investigation, digital forensics, platform disclosure requests, identification of suspects, or prosecution. (National Bureau of Investigation)

PNP Anti-Cybercrime Group

A complaint may also be filed with the PNP Anti-Cybercrime Group or its regional cybercrime units. Bring the device containing the original messages when practicable, together with printed and digital copies of the evidence.

CICC National Anti-Scam Hotline

The Cybercrime Investigation and Coordinating Center operates the 1326 National Anti-Scam Hotline for scam reports and coordination. Keep the reference number and provide it to the relevant bank, e-wallet, PNP unit, or NBI investigator. (Philippine Dictionary)

Office of the Prosecutor

A criminal complaint may ultimately proceed through preliminary investigation before the city, provincial, or DOJ prosecution office.

The DOJ checklist generally requires:

An Investigation Data Form;
A complaint-affidavit or sworn statement;
Affidavits of witnesses;
Supporting documents and electronic evidence;
Copies for each respondent; and
Proof identifying the respondent, when available.

Investigators commonly assist with case build-up before referral to the prosecutor, especially when court-authorized requests are needed to identify an anonymous account operator. (Department of Justice)

Documents to Prepare

Document or evidence	Why it matters
Valid government ID	Establishes your identity and may be required by platforms and agencies
Complaint-affidavit or sworn statement	Provides the chronological facts under oath
Profile URLs and usernames	Distinguishes the fake account from similarly named accounts
Original screenshots and screen recordings	Shows the account, content, context, and timestamps
Exported chats or downloaded account data	Preserves a fuller record than selected screenshots
Payment receipts and reference numbers	Allows banks and investigators to trace transactions
Affidavits of recipients or scam victims	Proves what was represented and why the recipient relied on it
Proof that you control the genuine account	Helps establish impersonation
Platform and bank ticket numbers	Shows prompt reporting and creates an audit trail
Incident chronology	Organizes multiple accounts, victims, and transactions
Special power of attorney	Needed when a representative is formally acting for the complainant
Corporate authorization documents	May be required when the impersonated party is a company

Initial NBI investigative assistance is listed as having no government fee. However, notarization, printing, courier services, certified copies, translations, apostilles, and professional digital-forensic services may involve separate expenses. (National Bureau of Investigation)

How Investigators Can Identify an Anonymous Account

A displayed name, photograph, or telephone number does not reliably identify the operator. Investigators may need subscriber information, login records, traffic data, linked telephone numbers, IP information, payment records, or information from another platform.

Under RA 10175 and the Rule on Cybercrime Warrants, law enforcement may seek court authority for the preservation, disclosure, collection, search, seizure, or examination of computer data. A valid, officially docketed complaint is important because disclosure requests must be connected to an assigned investigation. (Office of the Court Administrator)

Service providers generally retain traffic data and subscriber information for at least six months from the transaction. Content data may be preserved for six months after a lawful preservation order, with a possible one-time extension. This is one reason delays can seriously weaken a case. (Supreme Court E-Library)

Even with warrants, identification may be difficult when the offender used false registration data, public Wi-Fi, compromised devices, overseas infrastructure, cryptocurrency, or several money-mule accounts.

Filing a Privacy Complaint with the NPC

Before filing a formal NPC complaint, the complainant generally must notify the respondent in writing and allow the respondent to address the violation. The NPC’s rules ordinarily require proof that no timely or appropriate action was taken, or that no response was received within 15 calendar days.

A formal complaint should include a notarized complaint-assisted form or verified complaint, supporting evidence, and witness affidavits. It may be filed personally, by registered mail, by courier, or through an authorized electronic method. (National Privacy Commission)

The exhaustion requirement may be impractical where the offender is anonymous. In that situation, prioritize platform reporting, the bank or e-wallet report, and a criminal complaint. An NPC complaint may still be appropriate against an identifiable organization that leaked, disclosed, or failed to protect the information used in the scam.

Special Considerations for OFWs and Foreigners

A person does not have to be physically present in the Philippines to preserve evidence, report an account to a platform, or notify a Philippine bank or e-wallet.

For a formal Philippine proceeding:

Ask the receiving agency whether it will initially accept scanned affidavits or a remote interview.
A Philippine representative may need a special power of attorney.
An affidavit or SPA executed abroad may be notarized before a Philippine embassy or consulate.
Alternatively, a document notarized abroad may require an apostille from the competent authority of an Apostille Convention country.
Documents in a foreign language may need an English or Filipino translation acceptable to the receiving office.

Philippine consular officers can notarize affidavits and powers of attorney for use in the Philippines, while properly apostilled documents from member countries generally no longer require further Philippine embassy authentication. (Philippine Embassy in New Delhi)

Philippine jurisdiction may still exist where an element of the offense occurred in the Philippines, Philippine computer infrastructure was used, the victim was in the Philippines, or the affected financial account is maintained by an institution operating in the country. Cross-border identification and evidence requests, however, usually take longer. (Lawphil)

Common Mistakes That Weaken a Case

Reporting before preserving the evidence. The account may disappear before its URL, messages, and payment instructions are recorded.
Saving only cropped screenshots. Cropping can remove the username, URL, date, time, or surrounding conversation.
Deleting the original messages. Forwarded copies may not retain all metadata or context.
Waiting for several victims before reporting. Identity theft may already be reportable even before financial loss occurs.
Contacting only the platform. Takedown does not freeze funds or identify the operator.
Contacting only the bank. Financial tracing does not replace a cybercrime complaint.
Paying the impersonator to stop. Payment may encourage further extortion and does not guarantee deletion.
Publicly naming an unverified suspect. The visible account, telephone number, or receiving account may belong to another victim or money mule.
Creating a fake account to “fight back.” Impersonation, threats, unauthorized access, and publication of personal data can create separate liability.
Handing over the only copy of a device or file without an inventory. Keep copies and obtain a written acknowledgment for evidence surrendered to an investigator.

Frequently Asked Questions

Can I report a fake Facebook account even if nobody sent money?

Yes. Computer-related identity theft can be committed through the unauthorized use of identifying information. RA 10175 expressly provides a lower penalty where no damage has yet occurred, which indicates that actual financial loss is not always required.

Who should file the complaint: me or the person who was scammed?

Both may have separate interests. You are the victim of identity misuse and reputational harm. The person who sent money is the direct victim of the financial deception. Coordinated affidavits usually make the case stronger.

Can the police trace a fake social media account?

Potentially. Investigators may seek subscriber, traffic, device, payment, and account information through lawful processes. Tracing is not guaranteed, particularly when the operator used false information, overseas infrastructure, compromised accounts, or multiple intermediaries.

Can I force Facebook, Instagram, or another platform to remove the account?

Use the platform’s impersonation-reporting procedure first. A Philippine court may issue appropriate orders in a proper case, but court proceedings take longer and require a legal basis, evidence, and an identifiable controversy. Platform reporting is normally the fastest first remedy.

Should I send my government ID to prove that I am the real person?

Submit an ID only through the platform’s official reporting form or to a verified government agency, bank, or e-wallet. Do not send an ID through a link or email supplied by the suspected fake account.

Can I recover money sent to the scammer?

Recovery is possible but not assured. Immediate reporting gives the financial institution the best chance to hold or trace the funds. Recovery becomes harder after cash withdrawal, conversion to cryptocurrency, international transfer, or movement through several accounts.

What if the fake account uses my company’s name and logo?

RA 10175 covers identifying information belonging to natural and juridical persons. Preserve company registration records, official pages, trademarks, client warnings, and proof of unauthorized solicitations. The person filing for the company should carry appropriate corporate authority.

What if the scam uses an AI-generated photo, video, or voice recording?

Preserve the original file, source link, upload date, messages accompanying it, and any payment instructions. AI-generated media can still be part of identity theft, forgery, fraud, estafa, or other offenses when used to deceive people. Avoid repeatedly downloading and re-encoding the file because that may strip useful metadata.

Will a police blotter entry be enough?

A blotter entry helps document when the incident was reported, but investigators and prosecutors usually need a sworn complaint, supporting electronic evidence, witness statements, and transaction records. Obtain the blotter or reference number, then complete the formal complaint process.

Key Takeaways

Preserve the fake profile, complete URLs, messages, payment details, and original files before seeking removal.
Warn contacts through your genuine account without publicly exposing unnecessary personal or financial data.
Report any transfer immediately to the bank or e-wallet and ask for fraud escalation and temporary holding of disputed funds.
File with the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or CICC rather than relying only on a platform report.
The identity owner and the person who lost money may each provide separate affidavits and evidence.
Computer-related identity theft may be reported even when no one has yet suffered financial loss.
Keep unedited originals because screenshots and electronic messages must eventually be authenticated.
Act promptly because platform content, subscriber information, and recoverable funds can disappear quickly.